{"id":"CVE-2023-50255","aliases":["EUVD-2023-55070","GHSA-rw5r-8p9h-3gp2","OESA-2026-3506","OESA-2026-3507","OESA-2026-3508","OESA-2026-3509","openSUSE-SU-2023:0423-1","openSUSE-SU-2023:0424-1","openSUSE-SU-2024:13541-1"],"status":"published","title":"Zip Path Traversal in Deepin-Compressor","description":"Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01054,"percentile":0.64642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-23","CWE-26"],"published":"2023-12-27T16:16:51Z","modified":"2026-10-28T10:36:16Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP4","package":"deepin-compressor","fixed_in":["5.10.11-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"deepin-compressor","fixed_in":["5.12.13-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"deepin-compressor","fixed_in":["5.12.13-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"deepin-compressor","fixed_in":["5.12.13-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"deepin-compressor","fixed_in":["5.12.13-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"deepin-compressor","fixed_in":["5.12.13-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"deepin-compressor","fixed_in":["5.12.2-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"deepin-compressor","fixed_in":["5.12.2-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"deepin-compressor","fixed_in":["5.12.13-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.11-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.13-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.13-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.13-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.13-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.13-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.2-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.2-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"deepin-compressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.13-2.1"}]}]}],"products":[{"vendor":"deepin","product":"deepin-compressor"},{"vendor":"linuxdeepin","product":"developer-center"}],"references":[{"url":"https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory"]},{"url":"https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50255.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50255","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3506","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3507","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3508","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3509","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/E6RI57PVHBNFGBEIH77ZL73GRPMDNIGO/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218428","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50255","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DAZVQ2SNKDTHKSUK47UVIS2467BT56Z4/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50255","title":"Zip Path Traversal in Deepin-Compressor","description":"Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n","status":"published","published":"2023-12-27T16:16:51.459Z","modified":"2024-08-02T22:16:46.183Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-23","CWE-26","CWE-22"],"updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2023-55070","description":"Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n","status":"published","published":"2023-12-27T16:16:51Z","modified":"2024-08-02T22:16:46Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T03:49:55.131895Z"}],"nvd":[{"id":"CVE-2023-50255","description":"Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n","status":"published","published":"2023-12-27T17:15:07.847Z","modified":"2026-06-17T06:39:23.607Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22","CWE-23","CWE-26"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"CVE-2023-50255","title":"Zip Path Traversal in Deepin-Compressor","description":"Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n","status":"published","published":"2023-12-27T16:16:51.459Z","modified":"2026-10-28T10:36:16.926765291Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22","CWE-23","CWE-26"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"OESA-2026-3506","title":"deepin-compressor security update","description":".\r\n\r\nSecurity Fix(es):\n\nDeepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there\u0026apos;s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n(CVE-2023-50255)","status":"published","published":"2026-08-30T04:14:25Z","modified":"2026-08-30T04:31:37.938693145Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3507","title":"deepin-compressor security update","description":".\r\n\r\nSecurity Fix(es):\n\nDeepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there\u0026apos;s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n(CVE-2023-50255)","status":"published","published":"2026-08-30T04:14:26Z","modified":"2026-08-30T04:31:37.950369639Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3508","title":"deepin-compressor security update","description":".\r\n\r\nSecurity Fix(es):\n\nDeepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there\u0026apos;s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n(CVE-2023-50255)","status":"published","published":"2026-08-30T04:14:27Z","modified":"2026-08-30T04:31:37.931142639Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3509","title":"deepin-compressor security update","description":".\r\n\r\nSecurity Fix(es):\n\nDeepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there\u0026apos;s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n(CVE-2023-50255)","status":"published","published":"2026-08-30T04:14:28Z","modified":"2026-08-30T04:31:30.905902126Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"openSUSE-SU-2023:0423-1","title":"Security update for deepin-compressor","description":"This update for deepin-compressor fixes the following issues:\n\n- CVE-2023-50255: Fix Zip Path Traversal (boo#1218428)\n","status":"published","published":"2023-12-30T14:24:53Z","modified":"2026-02-04T03:12:55.397687Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2023:0424-1","title":"Security update for deepin-compressor","description":"This update for deepin-compressor fixes the following issues:\n\n- CVE-2023-50255: Fix Zip Path Traversal (boo#1218428)\n","status":"published","published":"2023-12-30T14:24:56Z","modified":"2026-02-04T04:39:14.762095Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13541-1","title":"deepin-compressor-5.12.13-2.1 on GA media","description":"These are all security issues fixed in the deepin-compressor-5.12.13-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:32.554646Z","updated_at":"2026-11-02T16:58:36.327643Z"}]}}